# Rollups ## Rollups on [[Bitcoin]] Thread by Eric Wall and commentary by many players https://twitter.com/ercwl/status/1497307148317044741?t=UBVSct1xYBfaHXWoaIDMMA&s=19 ## "I'm Worried Nobody Will Care About Rollups" https://medium.com/dragonfly-research/im-worried-nobody-will-care-about-rollups-554bc743d4f1 by [[Haseeb Qureshi]] ### Description Rollups are mini-blockchains that inherit the security properties of the blockchain they’re built on. - Even if the validators/operators of the rollup are untrustworthy, they cannot steal your funds (assuming the rollup is implemented correctly). There are two basic types of rollups: optimistic rollups and zero-knowledge rollups. 1. Optimistic rollups are secured via fraud proofs — _anyone is free to prove whether the computation is wrong_ 2. ZK rollups are secured via cryptography — _the math proves the computation is right_. A fuller treatment of rollups is out of scope here, but check out Vitalik's writup if you want to go deeper. ### Selected paragraphs #### Scaling on sidechains But now let’s take the second biggest story in [[Ethereum 1]] these last 6 months: the rise of [[Blockchain/Ethereum/Binance Smart Chain]] and [[Polygon]] (née Matic). - These are not rollups; they are more like sidechains—totally independent proof of stake Ethereum clones. - **They basically just take off-the-shelf Geth, rip out the consensus code, crank up the gas limit, and use a multisig to bridge back to Ethereum.** Both chains have taken off like gangbusters, and they’re now each doing more transactions than Ethereum itself. Other blockchains like [Avalanche](https://support.avax.network/en/articles/4058262-what-is-the-contract-chain-c-chain) and [NEAR](https://near.org/blog/aurora-launches-near/) are stepping up with their own EVM compatible systems that also bridge to Ethereum. The world basically looks like this now: ![[Pasted image 20210806160106.png]] It’s almost like sharding, but with Ethereum 1.0 as the “beacon chain.” Cross-chain transfers and messages are assisted by multisigs, makeshift bridges, and sure, a few trusted parties. I call this architecture the poor man’s sharding. It’s how [[DeFi]] is de facto scaling today. #### Using jank technology that was adopted while the elegant scaling solution was being built There once was a blockchain that didn’t scale. But then some really smart people invented ~trustless layer-2 technology~ that would scale the blockchain. Users were excited. Then, after years of hard work, the smart people finally built the layer-2. And when the users could get their hands on it, no one cared because they were already using some other simpler jank solution. Does this story ring a bell? Remember [[Lightning]]? People just used [[WBTC]]. Remember [[Plasma]]? People just used [[xDai]]. And now here we are, instead of waiting for rollups, people are just using [[Polygon]] and [[Blockchain/Ethereum/Binance Smart Chain|BSC]]. - TF? People are definitely using [[Lightning]]. But it’s hard to ignore that the great masses have already adopted Polygon and Binance Smart Chain. No VC thought leader saw this coming. **Huge number of users from developing countries — India, Indonesia, Thailand, Philippines — are embracing these platforms, and [many of them seem to have never used Ethereum before](https://ournetwork.substack.com/p/our-network-issue-69) (they’re priced out!).** Remember that whole “bank the unbanked” thing? Well, these platforms _actually_ have global reach, and appeal to what users actually care about. ##### Cost comparison Right now on [[Polygon]], a simple [[Uniswap]]-style trade costs $0.0001 - On [[Blockchain/Ethereum/Binance Smart Chain]], it costs $0.20. - On [[Ethereum 1]], it costs about $7. - And on [[Optimism]], it’ll cost around $0.68. Why are rollups more expensive than these sidechains? **This is because every rollup ultimately must post calldata onto Ethereum; this tethers their fees to Ethereum fees. Each rollup can only scale Ethereum by a constant factor.** So the fees won’t be _that_ low compared to what many users are already used to. #### VM incompatibility of rollups And none of the rollups are exactly EVM compatible — there are subtle differences between each of these rollups’ virtual machines and the EVM. - For Arbitrum, they use [AVM](https://developer.offchainlabs.com/docs/avm_specification) - For Optimism, [OVM](https://medium.com/ethereum-optimism/ovm-deep-dive-a300d1085f52), each of which subtly breaks some contracts and EVM-compatible tooling. - And for the ZK-rollups, that’s a whole nother universe — ZKRs will instead compile Solidity down to equivalent zero-knowledge circuits, to be executed in a ZK virtual machine. Now compare this to Polygon, where you literally just copy and paste your contracts and everything works. #### Moving funds in and out of rollups is slow or expensive Then consider the movement of funds in and out of rollups. **For optimistic rollups, when you want to withdraw funds, there is a ~1 week challenge period during which your withdrawal is frozen. This sucks.** So to facilitate “fast withdrawals,” market makers will stand ready to move your assets quickly across the boundary—for a fee. The fee they charge you will depend on their inventory and the liquidity of the asset. If you’re moving ETH, this will cost maybe 0.2% or something, but if you’re trying to move a random dog coin, it will likely cost much more, possibly 1% or higher. Some assets may not be possible to fast-withdraw at all if there’s not enough liquidity. As a user, you will need to consider all of this when you are planning out your rollup [[DeFi]] portfolio. That said, if you use a traditional multisig-based bridge into the rollup, you can avoid this withdrawal issue. But if you’re taking custody risk with a multisig-style bridge, what exactly is the improvement over Polygon? **(Note that ZK rollups don’t suffer from this issue, since their withdrawals are effectively instant.)** #### [[DeFi]] protocols are multi-homing Before all this started, here’s how I thought layer-2 would play out. Every DeFi protocol on [[Ethereum 1]] would commit to a layer-2 — some would choose [[Optimism]], some would choose [[Starkware]], and whoever collected the most brands would ultimately become the dominant rollup. It’s clear now that’s not the right mental model. Overwhelmingly, DeFi protocols are multi-homing. Already, AAVE, Sushi, and Curve have launched on Polygon, pushing its TVL to over $8B. Sushi is on more than [5 chains](https://cryptobriefing.com/sushiswap-now-live-fantom-polygon-xdai-binance-moonbeam/), Curve is on [4](https://ftm.curve.fi/). For a long time, Uniswap aligned themselves [exclusively with Optimism](https://twitter.com/Uniswap/status/1374407380520239109), but with the impending launch of Arbitrum, Uniswap changed its tune and will also be multi-homing. And [[Blockchain/Ethereum/Binance Smart Chain]] taught everyone: if you don’t launch here, we’ll just launch a fork of you and take the revenue you would’ve gotten. Going forward, I expect every major DeFi protocol will just launch on every important chain preemptively. #### The shitcoiners decide which protocols win So is it really true that the protocols are the ones who decide where users go? Or will it be the users who decide where the protocols go? Right now, the lesson of Polygon and Binance Smart Chain seems to be the latter — protocols are following the users, and they’re being handsomely rewarded for it. I can tell you, as an investor, the consensus right now is that rollups will win. Vitalik likes rollups. Everyone likes rollups. Rollups are the thing. Invest in rollups. **But I’m worried.** I’m worried that nobody is going to care. That people already have what rollups were originally promising: fast, cheap, EVM-compatible blockchains that integrate smoothly with the Ethereum ecosystem. #### How can rollups win? So how can rollups win in the long run? To my mind, there are two ways: one is that a non-rollup sidechain catastrophically fails, and the industry learns a lesson à la Mt. Gox. And catastrophically fail doesn’t just mean “nodes can’t sync.” It means “the money is gone” or “the chain has completely halted.” That’s possible, but probably unlikely. - This will probably happen lmao So that leaves us with the other way: **rollups have to actually become significantly better than the alternatives**. Decentralization virtue signaling is not enough. For this, I personally only see one path forward, which is the promise of cryptography and zero-knowledge proofs. #### The [[Zero-Knowledge]] tech has improved greatly The cryptography underlying zero knowledge proofs has undergone a Moore’s Law-like trajectory over the last few years, and it shows no sign of slowing down. It was previously thought to be infeasible to perform EVM-like computation in ZK rollups, and now [zkSync](https://twitter.com/zksync/status/1399469067795304451) and [Starkware](https://twitter.com/StarkWareLtd/status/1311044303439958017) are on the verge of launching exactly that, by recursively composing ZK-SNARKs to prove arbitrarily long chains of computation. In time, I expect that we’ll see much more than the constant factor scaling of rollups today: massive computational compression, privacy-preserving smart contracts, provable MEV resistance, and much more. **State growth** is also not as much of an issue in a ZK rollup, since no matter how large the state is, a user can always verify its correctness by simply verifying the sequence of SNARKs. #### Short run: [[zkSync]] and [[zkPorter]] But even in the short run, I’m excited for what Matter Labs is doing with zkSync 2.0 and its [zkPorter architecture](https://medium.com/matter-labs/zkporter-a-breakthrough-in-l2-scaling-ed5e48842fbf). zkPorter is a hybrid between a [Validium](https://medium.com/starkware/volition-and-the-emerging-data-availability-spectrum-87e8bfa09bb) and a ZK rollup, allowing users to seamlessly migrate between the two. The Validium side, with its data off-chain, can charge fees comparable to Polygon, while the more costly ZK rollup is still accessible for those who want greater security. This integrates the full spectrum of user choices under the same roof, with full interoperability between them. ![[Screen Shot 2021-08-06 at 4.20.53 PM.png]] ## [[Vitalik Buterin|Vitalik]]'s writup https://vitalik.ca/general/2021/01/05/rollup.html ## [[Matthew Green]]: The real problem is storage (of public state) https://threadreaderapp.com/thread/1413488249977278473.html Every article I read on (ZK) rollups almost gets to the real problem, and then misses it. The real problem is the need for storage. ZK proofs won’t solve this. I keep reading these articles that talk about the problems with rollups. And they’re good articles! E.g.: https://medium.com/dragonfly-research/im-worried-nobody-will-care-about-rollups-554bc743d4f1 But they always reach a point where they realize that the problem is state storage, and then they handwave that the solution is going to be something like Mina or zkSync, which don’t fully solve the state storage problem. The problem here is that smart contract systems have three kinds of state: 1. Public state (eg total supply of an ERC20) 2. User-owned state (eg your balance in an ERC20) 3. Useless cruft (eg a specific set of transaction structures, block headers, etc.) ZK-style rollups can help eliminate most of the cruft (category 3). In principle they can also push storage responsibility for some types of user-owned state onto the users themselves (with a lot of careful engineering work.) So what’s left is “only” public contract state. But that public contract state has to be held in a place where it is guaranteed to be available for a while, and can even be moved around if rollup servers die. I feel like all current public discussion discounts the scaling limitations this will create. Note that I’m not saying “nobody is working on this”. Lots of people are thinking about it. I just don’t think people are publicly explaining how much of a giant PITA it will be. And how ZK solutions (even if they work) will just leave you stuck with a state storage problem. And I’m afraid that given the incentives, there’s a very simple solution to all of this: just keep the state on a centralized server, rather than designing it to be available and move around. But once you do that, you may as well just be Binance Smart Chain.